PT-2018-4209 · Unknown · Ezpz One Click Backup

Henri Salo · Publicado 2018-04-10 · Atualizado 2018-05-18 · CVE-2014-3114

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EZPZ One Click Backup plugin versions 12.03.10 and earlier

Description The issue allows remote attackers to execute arbitrary commands. This is achieved via the cmd parameter to the "functions/ezpz-archive-cmd.php" endpoint.

Recommendations For versions 12.03.10 and earlier, consider disabling access to the "functions/ezpz-archive-cmd.php" endpoint until a patch is available. Avoid using the cmd parameter in the affected endpoint to minimize the risk of exploitation.

Correção

RCE

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2014-3114

Produtos afetados

Ezpz One Click Backup

Referências · 3

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3114 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3114 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/05/01/11 · Nota